By now, you’ve no doubt heard of WannaCry, the ransomware attack that impacted over 300,000 victims in more than 100 countries over the past 10 days. While we’ve all focused on effective patching strategies to prevent further infection, an important part of the discussion is how to plan for a successful incident response (IR) to ransomware and other types of attacks.

Nipping Ransomware in the Bud

When dealing with ransomware attacks, the primary goal is to avoid falling victim in the first place. The key is to consistently back up your most critical data. You should also ensure that your backup servers and systems aren’t always connected to the network. That way, a ransomware attack within your environment will have little impact, since you’ll still be able to access your critical data.

That said, an effective backup strategy is simply one part of a larger security and response plan, which should be developed proactively. To successfully combat ransomware and other types of targeted attacks, it’s critical to create an incident response plan, document it and test it regularly to identify gaps and changes within the environment.

Watch the webinar series: Orchestrate Your Security Defenses to Avoid Ransomware Attacks

Building an Effective Incident Response Plan

Organizations that have a documented incident response plan and an IR team, whether it’s internal, external or a combination of both, can respond to a breach more quickly than those who don’t. Organizations that are able to complete an investigation in 30 days or less save an average of $1,000,000 over those who don’t.

Furthermore, organizations that document their plans and test them quarterly or biannually are able to more effectively prepare for security incidents and practice their response actions in advance of a real attack. This allows these enterprises to accelerate the process of response and investigation, greatly reducing data exposure and financial losses.

An effective response plan should contain a broad scope of technical and nontechnical actions that need to be conducted by all stakeholders within the environment. This requires leaders to ask questions such as:

  • Does the information security team have the data needed to perform live responses on hosts in the environment? Is that data searchable from a central location? Are analysts able to pull data from or images of remote hosts when needed?
  • Does the organization have contracts in place with external crisis communications firms, outside legal counsel specializing in privacy and experienced incident response firms who can supplement the internal teams?
  • How do stakeholders within the organization communicate with each other when there is concern that email systems may be compromised by an unauthorized actor?
  • What information are employees authorized to communicate to third parties during a breach, if any? Are employees aware of this policy?
  • What type of communications will be shared with the news media by the organization? Are there holding statements already crafted that can be used in a crisis?

Documenting and regularly testing a variety of scenarios helps organizations determine where gaps may exist. Most importantly, this enables security teams to fix vulnerabilities in advance of a breach.

How IBM Can Help

The X-Force Incident Response and Intelligence Services (IRIS) team specializes in providing incident response planning, program development, response to critical breaches, remediation and threat intelligence to clients in over 133 countries. We have experience responding to and containing many of the largest data breaches in the world.

To learn more:

More from Incident Response

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication. Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future…

3 recommendations for adopting generative AI for cyber defense

3 min read - In the past eighteen months, generative AI (gen AI) has gone from being the source of jaw-dropping demos to a top strategic priority in nearly every industry. A majority of CEOs report feeling under pressure to invest in gen AI. Product teams are now scrambling to build gen AI into their solutions and services. The EU and US are beginning to put new regulatory frameworks in place to manage AI risks.Amid all this commotion, hackers and other cybercriminals are hardly…

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today